@atproto/pds 0.4.123 → 0.4.124

package/src/account-manager/db/migrations/005-oauth-account-management.ts

@@ -0,0 +1,112 @@
+import { Kysely } from 'kysely'
+import { HOUR } from '@atproto/common'
+import { ClientId, DeviceId } from '@atproto/oauth-provider'
+import { DateISO, JsonEncoded, toDateISO } from '../../../db'
+
+export async function up(
+  db: Kysely<{
+    device_account: {
+      did: string
+      deviceId: DeviceId
+
+      remember: 0 | 1
+      authenticatedAt: string
+      authorizedClients: JsonEncoded<ClientId[]>
+    }
+    account_device: {
+      did: string
+      deviceId: DeviceId
+
+      createdAt: DateISO
+      updatedAt: DateISO
+    }
+  }>,
+): Promise<void> {
+  // Security: Delete any leftover device accounts that are not remembered
+  await db
+    .deleteFrom('device_account')
+    .where('remember', '=', 0)
+    .where('authenticatedAt', '<', toDateISO(new Date(Date.now() - HOUR)))
+    .execute()
+
+  // replaces "device_account"
+  await db.schema
+    .createTable('account_device')
+    .addColumn('did', 'varchar', (col) => col.notNull())
+    .addColumn('deviceId', 'varchar', (col) => col.notNull())
+    .addColumn('createdAt', 'varchar', (col) => col.notNull())
+    .addColumn('updatedAt', 'varchar', (col) => col.notNull())
+    .addPrimaryKeyConstraint('account_device_pk', [
+      'deviceId', // first because this table will be joined from the "device" table
+      'did',
+    ])
+    .addForeignKeyConstraint(
+      'account_device_did_fk',
+      ['did'],
+      'account',
+      ['did'],
+      // cascade on delete, future-proofing on update (fk can't be altered)
+      (qb) => qb.onDelete('cascade').onUpdate('cascade'),
+    )
+    .addForeignKeyConstraint(
+      'account_device_device_id_fk',
+      ['deviceId'],
+      'device',
+      ['id'],
+      // cascade on delete, future-proofing on update (fk can't be altered)
+      (qb) => qb.onDelete('cascade').onUpdate('cascade'),
+    )
+    .execute()
+
+  // Migrate "device_account" to "account_device"
+  await db
+    .insertInto('account_device')
+    .columns(['did', 'deviceId', 'createdAt', 'updatedAt'])
+    .expression(
+      db
+        .selectFrom('device_account')
+        .select('did')
+        .select('deviceId')
+        .select('authenticatedAt as createdAt') // Best we can do
+        .select('authenticatedAt as updatedAt')
+        .where('remember', '=', 1),
+    )
+    .onConflict((oc) => oc.doNothing())
+    .execute()
+
+  // @NOTE No need to create an index on "deviceId" for "account_device" because
+  // it is the first column in the primary key constraint
+
+  await db.schema
+    .createIndex('account_device_did_idx')
+    .on('account_device')
+    .column('did')
+    .execute()
+
+  await db.schema
+    .createTable('authorized_client')
+    .addColumn('did', 'varchar', (col) => col.notNull())
+    .addColumn('clientId', 'varchar', (col) => col.notNull())
+    .addColumn('createdAt', 'varchar', (col) => col.notNull())
+    .addColumn('updatedAt', 'varchar', (col) => col.notNull())
+    .addColumn('data', 'varchar', (col) => col.notNull())
+    .addPrimaryKeyConstraint('authorized_client_pk', ['did', 'clientId'])
+    .addForeignKeyConstraint(
+      'authorized_client_did_fk',
+      ['did'],
+      'account',
+      ['did'],
+      // cascade on delete, future-proofing on update (fk can't be altered)
+      (qb) => qb.onDelete('cascade').onUpdate('cascade'),
+    )
+    .execute()
+
+  // We don't migrate the "device_account" authorized clients. Users will need
+  // to reauthorize the client during the next oauth flow (minor inconvenience
+  // for authenticated clients users).
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema.dropTable('authorized_client').execute()
+  await db.schema.dropTable('account_device').execute()
+}

package/src/account-manager/db/migrations/index.ts

@@ -2,10 +2,12 @@ import * as mig001 from './001-init'
 import * as mig002 from './002-account-deactivation'
 import * as mig003 from './003-privileged-app-passwords'
 import * as mig004 from './004-oauth'
+import * as mig005 from './005-oauth-account-management'
 
 export default {
   '001': mig001,
   '002': mig002,
   '003': mig003,
   '004': mig004,
+  '005': mig005,
 }

package/src/account-manager/db/schema/account-device.ts

@@ -0,0 +1,14 @@
+import { DeviceId } from '@atproto/oauth-provider'
+import { DateISO } from '../../../db'
+
+export interface AccountDevice {
+  did: string
+  deviceId: DeviceId
+
+  createdAt: DateISO
+  updatedAt: DateISO
+}
+
+export const tableName = 'account_device'
+
+export type PartialDB = { [tableName]: AccountDevice }

package/src/account-manager/db/schema/authorization-request.ts

@@ -1,11 +1,13 @@
 import { Selectable } from 'kysely'
 import {
+  ClientAuth,
   Code,
   DeviceId,
+  OAuthAuthorizationRequestParameters,
   OAuthClientId,
   RequestId,
 } from '@atproto/oauth-provider'
-import { DateISO, JsonObject } from '../../../db'
+import { DateISO, JsonEncoded } from '../../../db'
 
 export interface AuthorizationRequest {
   id: RequestId
@@ -13,8 +15,8 @@ export interface AuthorizationRequest {
   deviceId: DeviceId | null
 
   clientId: OAuthClientId
-  clientAuth: JsonObject
-  parameters: JsonObject
+  clientAuth: JsonEncoded<ClientAuth>
+  parameters: JsonEncoded<OAuthAuthorizationRequestParameters>
   expiresAt: DateISO
   code: Code | null
 }

package/src/account-manager/db/schema/authorized-client.ts

@@ -0,0 +1,19 @@
+import { Selectable } from 'kysely'
+import { AuthorizedClientData, OAuthClientId } from '@atproto/oauth-provider'
+import { DateISO, JsonEncoded } from '../../../db'
+
+export interface AuthorizedClient {
+  did: string
+  clientId: OAuthClientId
+
+  createdAt: DateISO
+  updatedAt: DateISO
+
+  data: JsonEncoded<AuthorizedClientData>
+}
+
+export type AuthorizedClientEntry = Selectable<AuthorizedClient>
+
+export const tableName = 'authorized_client'
+
+export type PartialDB = { [tableName]: AuthorizedClient }

package/src/account-manager/db/schema/index.ts

@@ -1,9 +1,10 @@
 import * as account from './account'
+import * as accountDevice from './account-device'
 import * as actor from './actor'
 import * as appPassword from './app-password'
 import * as oauthRequest from './authorization-request'
+import * as authorizedClient from './authorized-client'
 import * as device from './device'
-import * as deviceAccount from './device-account'
 import * as emailToken from './email-token'
 import * as inviteCode from './invite-code'
 import * as refreshToken from './refresh-token'
@@ -13,8 +14,9 @@ import * as usedRefreshToken from './used-refresh-token'
 
 export type DatabaseSchema = actor.PartialDB &
   account.PartialDB &
+  accountDevice.PartialDB &
+  authorizedClient.PartialDB &
   device.PartialDB &
-  deviceAccount.PartialDB &
   oauthRequest.PartialDB &
   token.PartialDB &
   usedRefreshToken.PartialDB &
@@ -26,8 +28,8 @@ export type DatabaseSchema = actor.PartialDB &
 
 export type { Actor, ActorEntry } from './actor'
 export type { Account, AccountEntry } from './account'
+export type { AccountDevice } from './account-device'
 export type { Device } from './device'
-export type { DeviceAccount } from './device-account'
 export type { AuthorizationRequest } from './authorization-request'
 export type { Token } from './token'
 export type { UsedRefreshToken } from './used-refresh-token'

package/src/account-manager/db/schema/token.ts

@@ -1,13 +1,16 @@
 import { Generated, Selectable } from 'kysely'
 import {
+  ClientAuth,
   Code,
   DeviceId,
+  OAuthAuthorizationDetails,
+  OAuthAuthorizationRequestParameters,
   OAuthClientId,
   RefreshToken,
   Sub,
   TokenId,
 } from '@atproto/oauth-provider'
-import { DateISO, JsonArray, JsonObject } from '../../../db/cast'
+import { DateISO, JsonEncoded } from '../../../db/cast'
 
 export interface Token {
   id: Generated<number>
@@ -18,10 +21,10 @@ export interface Token {
   updatedAt: DateISO
   expiresAt: DateISO
   clientId: OAuthClientId
-  clientAuth: JsonObject
+  clientAuth: JsonEncoded<ClientAuth>
   deviceId: DeviceId | null
-  parameters: JsonObject
-  details: JsonArray | null
+  parameters: JsonEncoded<OAuthAuthorizationRequestParameters>
+  details: JsonEncoded<OAuthAuthorizationDetails> | null
   code: Code | null
   currentRefreshToken: RefreshToken | null
 }

package/src/account-manager/helpers/account-device.ts

@@ -0,0 +1,66 @@
+import assert from 'node:assert'
+import { DeviceId } from '@atproto/oauth-provider'
+import { toDateISO } from '../../db'
+import { AccountDb } from '../db'
+import { selectAccountQB } from './account'
+
+export function upsertQB(db: AccountDb, deviceId: DeviceId, did: string) {
+  const now = new Date()
+
+  return db.db
+    .insertInto('account_device')
+    .values({
+      did,
+      deviceId,
+      createdAt: toDateISO(now),
+      updatedAt: toDateISO(now),
+    })
+    .onConflict((oc) =>
+      // uses pk
+      oc.columns(['deviceId', 'did']).doUpdateSet({
+        updatedAt: toDateISO(now),
+      }),
+    )
+}
+
+export function selectQB(
+  db: AccountDb,
+  filter: {
+    sub?: string
+    deviceId?: DeviceId
+  },
+) {
+  assert(
+    filter.sub != null || filter.deviceId != null,
+    'Either sub or deviceId must be provided',
+  )
+
+  return (
+    selectAccountQB(db, { includeDeactivated: true })
+      // note: query planner should use "account_device_pk" index
+      .innerJoin('account_device', 'account_device.did', 'actor.did')
+      .select([
+        'account_device.deviceId',
+        'account_device.createdAt as adCreatedAt',
+        'account_device.updatedAt as adUpdatedAt',
+      ])
+      .innerJoin('device', 'device.id', 'account_device.deviceId')
+      .select([
+        'device.sessionId',
+        'device.userAgent',
+        'device.ipAddress',
+        'device.lastSeenAt',
+      ])
+      .if(filter.sub != null, (qb) => qb.where('actor.did', '=', filter.sub!))
+      .if(filter.deviceId != null, (qb) =>
+        qb.where('account_device.deviceId', '=', filter.deviceId!),
+      )
+  )
+}
+
+export function removeQB(db: AccountDb, deviceId: DeviceId, did: string) {
+  return db.db
+    .deleteFrom('account_device')
+    .where('deviceId', '=', deviceId)
+    .where('did', '=', did)
+}

package/src/account-manager/helpers/authorization-request.ts

@@ -6,15 +6,15 @@ import {
   RequestId,
   UpdateRequestData,
 } from '@atproto/oauth-provider'
-import { fromDateISO, fromJsonObject, toDateISO, toJsonObject } from '../../db'
+import { fromDateISO, fromJson, toDateISO, toJson } from '../../db'
 import { AccountDb, AuthorizationRequest } from '../db'
 
 export const rowToRequestData = (
   row: Selectable<AuthorizationRequest>,
 ): RequestData => ({
   clientId: row.clientId,
-  clientAuth: fromJsonObject(row.clientAuth),
-  parameters: fromJsonObject(row.parameters),
+  clientAuth: fromJson(row.clientAuth),
+  parameters: fromJson(row.parameters),
   expiresAt: fromDateISO(row.expiresAt),
   deviceId: row.deviceId,
   sub: row.did,
@@ -37,8 +37,8 @@ const requestDataToRow = (
   deviceId: data.deviceId,
 
   clientId: data.clientId,
-  clientAuth: toJsonObject(data.clientAuth),
-  parameters: toJsonObject(data.parameters),
+  clientAuth: toJson(data.clientAuth),
+  parameters: toJson(data.parameters),
   expiresAt: toDateISO(data.expiresAt),
   code: data.code,
 })

package/src/account-manager/helpers/authorized-client.ts

@@ -0,0 +1,69 @@
+import {
+  AuthorizedClientData,
+  AuthorizedClients,
+  ClientId,
+  Sub,
+} from '@atproto/oauth-provider'
+import { fromJson, toDateISO, toJson } from '../../db'
+import { AccountDb } from '../db'
+
+export async function upsert(
+  db: AccountDb,
+  did: string,
+  clientId: ClientId,
+  data: AuthorizedClientData,
+) {
+  const now = new Date()
+
+  return db.db
+    .insertInto('authorized_client')
+    .values({
+      did,
+      clientId,
+      createdAt: toDateISO(now),
+      updatedAt: toDateISO(now),
+      data: toJson(data),
+    })
+    .onConflict((oc) =>
+      // uses "authorized_client_pk" idx
+      oc.columns(['did', 'clientId']).doUpdateSet({
+        updatedAt: toDateISO(now),
+        data: toJson(data),
+      }),
+    )
+    .executeTakeFirst()
+}
+
+export async function getAuthorizedClients(
+  db: AccountDb,
+  did: string,
+): Promise<AuthorizedClients> {
+  return (await getAuthorizedClientsMulti(db, [did])).get(did)!
+}
+
+export async function getAuthorizedClientsMulti(
+  db: AccountDb,
+  dids: Iterable<string>,
+): Promise<Map<Sub, AuthorizedClients>> {
+  // Using a Map will ensure unicity of dids (through unicity of keys)
+  const map = new Map<Sub, AuthorizedClients>(
+    Array.from(dids, (did) => [did, new Map()]),
+  )
+
+  if (map.size) {
+    const found = await db.db
+      .selectFrom('authorized_client')
+      .select('did')
+      .select('clientId')
+      .select('data')
+      // uses "authorized_client_pk"
+      .where('did', 'in', [...map.keys()])
+      .execute()
+
+    for (const { did, clientId, data } of found) {
+      map.get(did)!.set(clientId, fromJson(data))
+    }
+  }
+
+  return map
+}

package/src/account-manager/helpers/device.ts

@@ -3,7 +3,9 @@ import { DeviceData, DeviceId } from '@atproto/oauth-provider'
 import { fromDateISO, toDateISO } from '../../db'
 import { AccountDb, Device } from '../db'
 
-export const rowToDeviceData = (row: Selectable<Device>): DeviceData => ({
+export const rowToDeviceData = (
+  row: Omit<Selectable<Device>, 'id'>,
+): DeviceData => ({
   sessionId: row.sessionId,
   userAgent: row.userAgent,
   ipAddress: row.ipAddress,

package/src/account-manager/helpers/token.ts

@@ -2,75 +2,34 @@ import { Selectable } from 'kysely'
 import {
   Code,
   NewTokenData,
-  OAuthAuthorizationDetail,
   RefreshToken,
   TokenData,
   TokenId,
-  TokenInfo,
 } from '@atproto/oauth-provider'
-import {
-  fromDateISO,
-  fromJsonArray,
-  fromJsonObject,
-  toDateISO,
-  toJsonArray,
-  toJsonObject,
-} from '../../db'
+import { fromDateISO, fromJson, toDateISO, toJson } from '../../db'
 import { AccountDb, Token } from '../db'
-import { ActorAccount, selectAccountQB } from './account'
-import {
-  SelectableDeviceAccount,
-  toAccount,
-  toDeviceAccountInfo,
-} from './device-account'
-
-type LeftJoined<T> = { [K in keyof T]: null | T[K] }
+import { selectAccountQB } from './account'
 
-export type ActorAccountToken = Selectable<ActorAccount> &
-  Selectable<Omit<Token, 'id' | 'did'>> &
-  LeftJoined<SelectableDeviceAccount>
-
-export const toTokenInfo = (
-  row: ActorAccountToken,
-  audience: string,
-): TokenInfo => ({
-  id: row.tokenId,
-  data: {
+export function toTokenData(row: Selectable<Token>): TokenData {
+  return {
     createdAt: fromDateISO(row.createdAt),
     expiresAt: fromDateISO(row.expiresAt),
     updatedAt: fromDateISO(row.updatedAt),
     clientId: row.clientId,
-    clientAuth: fromJsonObject(row.clientAuth),
+    clientAuth: fromJson(row.clientAuth),
     deviceId: row.deviceId,
     sub: row.did,
-    parameters: fromJsonObject(row.parameters),
-    details: row.details
-      ? fromJsonArray<OAuthAuthorizationDetail>(row.details)
-      : null,
+    parameters: fromJson(row.parameters),
     code: row.code,
-  },
-  account: toAccount(row, audience),
-  info:
-    row.authenticatedAt != null &&
-    row.authorizedClients != null &&
-    row.remember != null
-      ? toDeviceAccountInfo(row as SelectableDeviceAccount)
-      : undefined,
-  currentRefreshToken: row.currentRefreshToken,
-})
+  }
+}
 
 const selectTokenInfoQB = (db: AccountDb) =>
   selectAccountQB(db, { includeDeactivated: true })
     // uses "token_did_idx" index (though unlikely in practice)
     .innerJoin('token', 'token.did', 'actor.did')
-    .leftJoin('device_account', (join) =>
-      join
-        // uses "device_account_pk" index
-        .on('device_account.did', '=', 'token.did')
-        // @ts-expect-error "deviceId" is nullable in token
-        .on('device_account.deviceId', '=', 'token.deviceId'),
-    )
     .select([
+      'token.id',
       'token.tokenId',
       'token.createdAt',
       'token.updatedAt',
@@ -83,9 +42,6 @@ const selectTokenInfoQB = (db: AccountDb) =>
       'token.details',
       'token.code',
       'token.currentRefreshToken',
-      'device_account.authenticatedAt',
-      'device_account.authorizedClients',
-      'device_account.remember',
     ])
 
 export const createQB = (
@@ -100,11 +56,11 @@ export const createQB = (
     expiresAt: toDateISO(data.expiresAt),
     updatedAt: toDateISO(data.updatedAt),
     clientId: data.clientId,
-    clientAuth: toJsonObject(data.clientAuth),
+    clientAuth: toJson(data.clientAuth),
     deviceId: data.deviceId,
     did: data.sub,
-    parameters: toJsonObject(data.parameters),
-    details: data.details ? toJsonArray(data.details) : null,
+    parameters: toJson(data.parameters),
+    details: data.details ? toJson(data.details) : null,
     code: data.code,
     currentRefreshToken: refreshToken || null,
   })
@@ -120,6 +76,7 @@ export const findByQB = (
   db: AccountDb,
   search: {
     id?: number
+    did?: string
     code?: Code
     tokenId?: TokenId
     currentRefreshToken?: RefreshToken
@@ -127,6 +84,7 @@ export const findByQB = (
 ) => {
   if (
     search.id === undefined &&
+    search.did === undefined &&
     search.code === undefined &&
     search.tokenId === undefined &&
     search.currentRefreshToken === undefined
@@ -140,6 +98,10 @@ export const findByQB = (
       // uses primary key index
       qb.where('token.id', '=', search.id!),
     )
+    .if(search.did !== undefined, (qb) =>
+      // uses "token_did_idx" index
+      qb.where('token.did', '=', search.did!),
+    )
     .if(search.code !== undefined, (qb) =>
       // uses "token_code_idx" partial index (hence the null check)
       qb
@@ -175,7 +137,7 @@ export const rotateQB = (
 
       expiresAt: toDateISO(newData.expiresAt),
       updatedAt: toDateISO(newData.updatedAt),
-      clientAuth: toJsonObject(newData.clientAuth),
+      clientAuth: toJson(newData.clientAuth),
     })
     // uses primary key index
     .where('id', '=', id)